A vulnerability was found in cri-o (affected version not known). It has been declared as problematic. This vulnerability affects some unknown functionality of the component Container Handler. The manipulation with an unknown input leads to a cleanup vulnerability. The CWE definition for the vulnerability is CWE-460. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow. As an impact it is known to affect availability. CVE summarizes:

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.

The weakness was released 11/25/2019 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability was named CVE-2019-14891 since 08/10/2019. The exploitation appears to be difficult. The attack can be initiated remotely. A single authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Name

• cri-o

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion